IBM Security Z Security

 View Only

 Find dsn profiles with a blank custom data field or missing custom data field

Jump to  Best Answer
Scott Lahner's profile image
Scott Lahner posted Mon June 23, 2025 11:57 AM

To find profiles where:

  • $field1 is missing or blank, or
  • custom_data is missing entirely,

I can use the following carla statements to identify when a profile has a $field1 value or when profiles have a custom data field. But when I reverse the logic it returns zero records, but there are profiles without a $field1 value defined or do not have a custom data field at all.

n type=racf   <-- This works
s class=dataset segment=csdata $field1>' '
sortlist key(44) custom_data
n type=racf   <-- This works
s class=dataset segment=csdata exists(custom_data)
sortlist key(44) custom_data
The below carla statements return zero records but this is not accurate. There are dsn profiles with no custom data fields or $field1 value = 'blank'
n type=racf   <-- zero records
s class=dataset segment=csdata $field1=' '
sortlist key(44) custom_data
n type=racf   <-- zero records but not accurate
s class=dataset segment=csdata missing(custom_data)
sortlist key(44) custom_data
When dealing with UserIDs I can use carla statement x $field1<>' ' to identify missing custom data fields or fields contaning blanks, but dsn and general profiles seem to act differently than UserIDs when dealing with custom data fields.  Any suggestions for finding profiles with blanks in a field or missing a custom data field?

Thanks Jeroen, so using that logic (you cannot directly select a record that is not there) I think the following carla would identify DSN profiles that are missing $FIELD1 or have a blank value in $FIELD1, would you agree?

N TYPE=RACF NAME=CSDATA OUTLIM=0                  
S C=DATASET SEGMENT=CSDATA EXISTS($FIELD1) and,   
not($FIELD1=' ')                                  
SORTLIST KEY                                      
N TYPE=RACF NAME=NOCSDATA NOTPROFLIST=CSDATA PL=0,
TT='Total DSN Profiles missing $FIELD1 values = '  
S C=DATASET SEGMENT=BASE                          
SORTLIST KEY :$FIELD1(7)                          
sum count(tt)                                     

Jeroen Tiggelman's profile image
Jeroen Tiggelman posted Tue June 24, 2025 09:30 AM  Best Answer

Hi Scott,

In TYPE=RACF the individual records are (physical) profile segments, not (logical) profiles.

You cannot directly select on a record (CSDATA segment) that is not there.

What you can do, is use the PROFLIST and NOTPROFLIST features to link segments for the same profile together.

So, you can select all CSDATA segments, then use NOTPROFLIST to exclude those profiles from another selection for all BASE segments.

N TYPE=RACF NAME=CSDATA OUTLIM=0
S C=DATASET SEGMENT=CSDATA
SORTLIST KEY

N TYPE=RACF NAME=NOCSDATA NOTPROFLIST=CSDATA
S C=DATASET SEGMENT=BASE
SORTLIST KEY

Rob van Hoboken's profile image
Rob van Hoboken IBM Champion posted Tue June 24, 2025 03:03 AM

Using a field name in a SELECT statement has 2 results.  First, it checks that the field exists in the record, i.e., it is not missing.  Then it checks the value of the field with the value supplied in the SELECT parameter.  So select $field1=' ' only selects CSDATA segments where a CSKEY entry contains $FIELD1, and where the corresponding CSVALUE entry contains a space.

If you want to find all CSDATA segments where $FIELD is not found, use select s=csdata not(cskey=$field1).  You should have success with select s=csdata missing($field1)but I have not tried it.

I am not entirely sure what you mean with "custom_data is missing entirely", but I would split this up into 

  • no CSDATA segment, and
  • a CSDATA segment with CSCNT=0, i.e., select s=csdata cscnt=0
Scott Lahner's profile image
Scott Lahner posted Tue June 24, 2025 09:11 AM

Rob, what I meant by custom_data missing entirely was profiles with no csdata segment. 

I have tried not(cskey=$FIELD1) and missing($FIELD1) and I always receive 0 records. 

I have also tried these statements with the same results (0 records): (field=$FIELD1 fieldvalue=' '),    S c=dataset segment=CSDATA  (custom_data(cstype=char cskey=$FIELD1, csvalue=` `) or custom_data(cstype^=char cskey=$FIELD1)).

The only way I am able to locate records where $FIELD1 is blank is by listing all dsn profiles from the base segment and doing a lookup on $FIELD1, like below:n type=racf pl=0,                                   
tt='Total DSN Profiles without a $FIELD1 value =  ' 
s c=dataset segment=base                            
sortlist key :$field1   sum (count,tt)                      

Note: When searching the csdata segement for UserIDs I have found using missing($field1) will not identify $field1 values with blanks       

Related Content